[Bro] New bro types when writing a plugin

D.W. brot212 at googlemail.com
Tue Mar 27 09:31:57 PDT 2018


Hey there,

I'm writing an analyzer as a plugin and I would like to create some new 
bro data type (record type to be exact) to hand over some protocol data 
in a compact form as parameters to the event functions.

For now I have declared the new types in types.bif and defined them in 
init-bare.bro, but I don't think that this is the right way, because I 
have to manually modify the bro source files.

Is there a way to declare and define the new type inside the plugin 
source files, so that the types will be featured in bro after the plugin 
was installed?

Greetings,

Dane



More information about the Bro mailing list